Possible to enforce or audit events passing through a Relay before arriving at Sentry?

### Environment

SaaS (https://sentry.io/)

### Possibly Related Issues
- https://github.com/getsentry/sentry/issues/60385
- https://github.com/getsentry/sentry/issues/46757

### What are you trying to accomplish?

Hi ingest team, looked into this a bit but wanted to ensure I don’t miss something. Asking on behalf of a customer who is setting up a Relay to scrub data before it arrives at Sentry:

Context: A customer is responsible for a number of teams and wants to ensure that they all send events through Relay, rather than sending directly via sentry.io DSNs. They wrote:

> We depend on the relay for scrubbing eventual confidential data before it gets out of our infra; we want to be able to audit if some traces were sent without going through the relay to be able to take actions. I understand to have the relay in the chain, we have to modify the DSN so that apps send traffic to the indicated host.
>
> However it seems we can’t prevent misconfigurations of developers taking the vanilla dsn and putting it in their configs.
Ideally we would have the sentry app to deny events that do not originate for the relay. An alternative would be that the relay adds a “flag” to events like “relayed=true” so that we can look for traces that don’t have it.

- Is there a way of either enforcing that events have passed through a Relay (instead of being sent directly to Sentry.io) to be accepted, or at least marking those events with something like relayed=true for later audit to differentiate between events sent via Relay / non-Relay?

### How are you getting stuck?

I didn't find a configuration option in the [Relay docs](https://docs.sentry.io/product/relay/options/) for this kind of thing. I also didn't find anything that looked promising through skimming the Relay codebase.

To my understanding, enforcing that events must pass through Relay is not possible from the Sentry perspective, based on [this GitHub issue](https://github.com/getsentry/sentry/issues/60385).

If we can't enforce events passing through Relay, we may be able to at least audit them. Here are some thoughts for workarounds to make events auditable later:
- Modify the Relay code to tag events with relayed=true
- (downside: deviates from Sentry’s official Relay code, upside: reasonably simple)
- In static Relay mode, one could define a scrubbing rule that replaces/adds to the message of every event with the string relayed=true . Events could then later be queried in Sentry with message:relayed=true*
- (downside: this is clunky and requires static mode, because if such a scrubbing rule were defined in Sentry.io and pulled via managed mode, then it would also be applied to the events that are sent directly to Sentry via sentry.io DSNs)

### Overall ask:
1. Is there a way of enforcing or at least marking events that have passed through Relay in an official way?
Of the workarounds mentioned, is there one that jumps out as a ‘best choice’?
2. Are there other possible workarounds I didn’t think of that would be better?

### Where in the product are you?

Settings - Relay

### Link

_No response_

### DSN

_No response_

### Version

_No response_

┆Issue is synchronized with this [Jira Improvement](https://getsentry.atlassian.net/browse/FEEDBACK-2134) by [Unito](https://www.unito.io)